u/Basic_Swordfish_2077

curious how common this is. found a guy in washington, east coast, renting out bare metal, and what got my attention was he could hand over multiple ips and actually control them himself.

but what im actually more curious about is the people doing it on a plain big-carrier business line. spectrum business, att fiber, verizon, frontier, ziply, that sort of thing, with a static block on it.

does anyone here have something similar on the west coast and how?

Small hosting store. Over the last 48 hours we've had around 90 payment attempts from 10+ throwaway accounts across half a dozen disposable email domains. About 80 declined. The ones that went through bought real servers, and at least one was used hard, over a terabyte of traffic in five days, before we caught it.

So this isn't just someone probing to see which stolen cards are live. They're getting the product too. They work through a stack of cards until one clears, take the goods, and move to a fresh account when that one's burned.

The part that should worry other merchants is that I had no way to stop any of it.

Whop authorizes the card before my webhook fires. By the time I hear about a payment, the charge has already happened. I cannot decline. I can only react.

Setting stock to 0 doesn't stop it. The card is still authorized, the order just fails afterwards, so they still learn the card works.

Hiding or archiving products doesn't stop it either. They were still generating checkouts against hidden, zero stock plans.

There are no merchant blocklists. I can't block a user, an email domain, or an IP. My only real lever is closing my whole store, which I've now done twice.

And payment.failed webhooks only carry a payment id. No card, no email, no amount. Those are on payment.created. So building my own velocity rules means pairing the two events myself before I can even count anything.

Support's advice after 22 hours, and after LITERALLY closing my first ticket, was to archive my products and make new hidden ones. That's not a fix, that's closing my business, and it didn't stop them anyway.

I've written my own detection since. Per card decline tracking, disposable domain checks, identity velocity, a store wide breaker, and hold-don't-provision on anything flagged. It DOES NOT work. I'm doing a payment processor's job without any of the correct or available tooling, and none of it prevents the authorisation, which is where the actual fraud happens and once it happens its too late.

The thing I keep coming back to is that those successful charges are going to be disputed by the real cardholders eventually, and that lands on Whop's payment rails, not just on me. If one small store can be used to turn stolen cards into delivered goods this easily, that's not really just a me problem.

Questions for other merchants:

Has anyone got velocity limiting applied on failed auths, by account, domain or IP?

Has anyone actually reached Trust and Safety during a live attack, so far i have to wait 3-5 hours per response and its always been "hurrr durrrr you should shut down your store and fuck off bye"

Is there merchant side blocking I've missed other than 3ds? 3ds blocks almost all of my real customers who are from countries who's banks who do not support 3ds

bit of an odd ask but this seemed like the right place for it. im looking for someone on a ziply business line, ideally with a static block and a multi-gig plan, whod rent me a machine sitting on it.

not colo, i dont want to ship hardware in. id rather rent something you already have and an old dell or supermicro is plenty for what im doing.

what matters to me is the ips coming off ziplys allocation rather than a hosting company, and having more than a gig on the line. 4-8 static to start, more later if it goes well. anywhere in the ziply footprint works, wa or or preferred.

dm me if thats you. paying monthly, happy to pay up front, and ill pay a premium per ip.

long shot but worth asking. if you have a business internet line with a static block and a rack with room in it, id rent a machine off you.

doesnt need to be anything nice, an old dell or supermicro is fine. what i actually care about is the ip space being on your isps allocation rather than a hosting company, and having more than a gig on it, 2.5g or 10g.

4-8 ips to start, more later if it goes well. west coast preferred. budget is flexible, monthly, and ill pay up front.

dm me if youve got a spare box and a business line. ill pay a premium per ip, its worth it to me to get the right space.

looking for somewhere on the west coast to put a box or two, wa/or/ca preferred.

few things im after. id want to rent a machine from you rather than ship my own in, and it doesnt need to be anything modern, an old xeon is plenty. the ipv4 needs to classify as isp or business class rather than datacenter. and on speed a single gig isnt enough for me, im after 2.5g or 10g.

4-8 ips to start, scaling well into the tens if it works out.

small operators very welcome, honestly prefer it. if you run a wisp or a small isp and have rack space sitting there, thats exactly what im looking for.

dm me if you have this. paying monthly, happy to pay up front, and ill pay a premium per ip for the right setup.

a few days ago my sub agents started spawning their own sub agents. genuinely just blasted through 90% of my 5hr limit in 5m doing a simple research task..... each sonnet agent spawned 5 more and so on and so on